ci: harden supply chain and streamline Dependabot automation - #393
Merged
Conversation
Replace mutable version tags (e.g. @v6) with immutable SHA digests for actions/checkout, actions/setup-node, actions/upload-artifact, github/codeql-action, and peaceiris/actions-hugo across all workflow files to improve supply-chain security.
Replace the inline dependabot-merge and dependabot-rebase-sweep job implementations with calls to sortie-ai/shared-workflows, pinned to an immutable SHA. Adds concurrency guard to the rebase-sweep workflow and updates its cron schedule from every 6 hours to every hour.
Update dependabot.yml to switch from daily to weekly (Tuesday) updates, lower the open PR limit from 20 to 10, add labels for dependency type, group all minor/patch updates into a single PR, and align commit-message prefix format with Conventional Commits. Expand CODEOWNERS to assign granular ownership: npm lock files to cicdbot, workflow files to cicdbot + human reviewers, and sensitive CI config (dependabot.yml, CODEOWNERS) to humans only. Add serghei-dev as co-owner alongside sergeyklay.
✅ Deploy Preview for gohugo-theme-ed ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR hardens CI supply-chain security by pinning GitHub Actions to immutable commit SHAs and streamlines Dependabot automation by replacing large inline workflows (and a local composite action) with pinned calls to shared reusable workflows. It also reduces Dependabot noise by switching to weekly, grouped updates with a lower open-PR cap.
Changes:
- Pin third-party GitHub Actions in existing workflows to specific SHA digests.
- Replace inline Dependabot merge + rebase-sweep logic with reusable workflows from
sortie-ai/shared-workflows(pinned tod7d3eee…), and remove the now-unused local composite action. - Tighten Dependabot settings (weekly cadence, grouped npm minor/patch updates, reduced PR limits, standardized commit-message prefixes/scopes).
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/playwright.yml | Pins checkout/setup-node/hugo/upload-artifact actions to SHAs. |
| .github/workflows/cs.yml | Pins checkout/setup-node actions to SHAs. |
| .github/workflows/codeql-analysis.yml | Pins checkout/codeql/hugo/setup-node actions to SHAs. |
| .github/workflows/dependabot-rebase-sweep.yml | Switches to hourly schedule + concurrency guard; delegates to shared reusable workflow. |
| .github/workflows/dependabot-merge.yml | Delegates Dependabot automerge to shared reusable workflow (but job gating needs correction). |
| .github/dependabot.yml | Moves to weekly cadence, adds grouping, lowers open PR limits, standardizes commit messages/labels. |
| .github/CODEOWNERS | Refines ownership rules to separate bot-approvable vs human-only sensitive CI config. |
| .github/actions/dependabot-rebase/action.yml | Deletes the local composite action replaced by shared reusable workflows. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Scope & Context
Type: Chore
Intent: Harden the CI supply chain by pinning all third-party GitHub Actions to immutable SHA digests, and reduce maintenance overhead by replacing two large inline Dependabot automation jobs with calls to shared reusable workflows. Dependabot configuration is also tightened: weekly batched updates replace noisy daily PRs.
Related Issues: #none
🧭 Reviewer Guide
Complexity: Medium
Entry Point
.github/workflows/dependabot-merge.ymland.github/workflows/dependabot-rebase-sweep.ymlare the most significant changes: ~400 lines of inline shell scripting are replaced by two-lineuses:references tosortie-ai/shared-workflows, pinned tod7d3eee(v1.0.0). The deleted.github/actions/dependabot-rebase/action.ymlwas the local composite action consumed by both workflows and is no longer needed.Sensitive Areas
.github/CODEOWNERS: Ownership rules now distinguish between bot-approvable files (npm lockfiles, workflow files) and human-only sensitive config (dependabot.yml, CODEOWNERS itself). Verify the patterns match the intended review requirements..github/dependabot.yml: The open PR limit drops from 20 to 10 and minor/patch npm updates are now batched into a single grouped PR. Confirm this grouping strategy is acceptable before merging.